Every hole in the gate is signed

The pre-commit screen’s exemptions had silently stopped applying — now every hole in every gate carries a pattern, a reason, a date and an author.